CVE-2024-7027: 
WordPress vulnerability analysis and mitigation

The WooCommerce - PDF Vouchers plugin for WordPress contains an authentication bypass vulnerability (CVE-2024-7027) in versions up to and including 4.9.3. The vulnerability was discovered and disclosed on July 23, 2024. This security flaw affects the QR code login functionality within the plugin (NVD).

The vulnerability stems from insufficient verification of user credentials during QR code login processes through the plugin. The issue has been assigned a CVSS v3.1 base score of 7.3 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. It has been classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) (Wordfence).

The vulnerability allows unauthenticated attackers to log in as any existing Voucher Vendor user on the site, provided they have access to the user ID. This could lead to unauthorized access to vendor accounts and potentially compromise the security of the voucher system (NVD).

The vulnerability can be exploited by unauthenticated attackers who have knowledge of a valid user ID. The attack requires no special privileges or user interaction, making it relatively straightforward to exploit (Wordfence).

Users are advised to update their WooCommerce PDF Vouchers plugin to a version newer than 4.9.3 to address this vulnerability (CodeCanyon).